CVE-2023-33181

Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://claroty.com/team82/disclosure-dashboard	Issue Tracking Third Party Advisory
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m	Vendor Advisory
https://xibosignage.com/blog/security-advisory-2023-05/	Vendor Advisory
https://claroty.com/team82/disclosure-dashboard	Issue Tracking Third Party Advisory
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m	Vendor Advisory
https://xibosignage.com/blog/security-advisory-2023-05/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*

History

28 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Xibo es un sistema de gestión de contenido (CMS). A partir de la versión 3.0.0 y antes de la versión 3.3.5, algunas rutas de la API imprimirán un seguimiento de pila cuando se llamen con parámetros faltantes o inválidos, revelando información sensible sobre las ubicaciones de las rutas que el servidor está utilizando. Los usuarios deberían actualizar a la versión 3.3.5, que corrige este problema. No existen soluciones alternativas conocidas aparte de la actualización.

Information

Published : 2023-05-30 21:15

Updated : 2026-10-28 19:10

NVD link : CVE-2023-33181

Mitre link : CVE-2023-33181

CVE.ORG link : CVE-2023-33181

JSON object : View

Products Affected

xibosignage

xibo

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2023-33181", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-33181", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-09T18:48:16.050881Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "xibosignage", "product": "xibo-cms", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.3.5"}]}]}], "published": "2023-05-30T21:15:09.207", "references": [{"url": "https://claroty.com/team82/disclosure-dashboard", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://xibosignage.com/blog/security-advisory-2023-05/", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://claroty.com/team82/disclosure-dashboard", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://xibosignage.com/blog/security-advisory-2023-05/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-209"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading."}, {"lang": "es", "value": "Xibo es un sistema de gesti\u00f3n de contenido (CMS). A partir de la versi\u00f3n 3.0.0 y antes de la versi\u00f3n 3.3.5, algunas rutas de la API imprimir\u00e1n un seguimiento de pila cuando se llamen con par\u00e1metros faltantes o inv\u00e1lidos, revelando informaci\u00f3n sensible sobre las ubicaciones de las rutas que el servidor est\u00e1 utilizando. Los usuarios deber\u00edan actualizar a la versi\u00f3n 3.3.5, que corrige este problema. No existen soluciones alternativas conocidas aparte de la actualizaci\u00f3n."}], "lastModified": "2026-10-28T19:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9A69FAF-8979-43F9-AA38-10568026EFE4", "versionEndExcluding": "3.3.5", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}